Commit 1731160f authored by Giovanni Cabiddu's avatar Giovanni Cabiddu Committed by Herbert Xu
Browse files

crypto: qat - set to zero DH parameters before free 



Set to zero the context buffers containing the DH key before they are
freed.
This is a defense in depth measure that avoids keys to be recovered from
memory in case the system is compromised between the free of the buffer
and when that area of memory (containing keys) gets overwritten.

Cc: stable@vger.kernel.org
Fixes: c9839143 ("crypto: qat - Add DH support")
Signed-off-by: default avatarGiovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: default avatarAdam Guerin <adam.guerin@intel.com>
Reviewed-by: default avatarWojciech Ziemba <wojciech.ziemba@intel.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 349d03ff

drivers/crypto/qat/qat_common/qat_asym_algs.c

+3 −0
Original line number Diff line number Diff line
@@ -420,14 +420,17 @@ static int qat_dh_set_params(struct qat_dh_ctx *ctx, struct dh *params) 
static void qat_dh_clear_ctx(struct device *dev, struct qat_dh_ctx *ctx)

{

	if (ctx->g) {

		memset(ctx->g, 0, ctx->p_size);

		dma_free_coherent(dev, ctx->p_size, ctx->g, ctx->dma_g);

		ctx->g = NULL;

	}

	if (ctx->xa) {

		memset(ctx->xa, 0, ctx->p_size);

		dma_free_coherent(dev, ctx->p_size, ctx->xa, ctx->dma_xa);

		ctx->xa = NULL;

	}

	if (ctx->p) {

		memset(ctx->p, 0, ctx->p_size);

		dma_free_coherent(dev, ctx->p_size, ctx->p, ctx->dma_p);

		ctx->p = NULL;

	}